What's new in Version 10.0.3.0

This page details the enhancements in IBM® API Connect Version 10.0.3.0 over the previous Version 10.0.2.0 release.

If you are moving to Version 10 from Version 5, also see the What's new in Version 2018 page for the additional new features since Version 5.

Note: You can access the latest files from Fix Packs Available for IBM API Connect v10.

What's new for Developers

New OpenAPI 2.0 editor

A new API editor is provided for OpenAPI 2.0 APIs. This editor is based on the design of the OpenAPI 3.0 editor that was introduced in IBM API Connect Version 10.0.1.1. For more information, see Editing an OpenAPI 2.0 API definition.

Search expanded to all list pages

The Search feature in lets you search the items displayed in list pages in API Manager and API Designer. Previously this feature was limited to a subset of list pages, but is now available in API Manager and API Designer all pages that display lists. For information on the Search feature, see Searching list pages.

Specify the HTTP status code and reason phrase when throwing an error

When configuring a Throw policy in the catch block of an API assembly, you can now specify the HTTP status code and reason phrase. For more information, see throw.

Enable persistent connections to a target endpoint

A new Persistent Connection option has been added to the Invoke policy that, when selected, enables persistent connections to the target endpoint, allowing connection re-use. For more information, see Invoke.

Specify the type of content to log for the Log policy

When configuring a Log policy in an API assembly, a new Log Level property allows you to specify the type of content to log. For more information, see Log.

Designate an error global policy

You can now deploy an error global policy to a gateway service, to be called whenever an error is thrown. For more information, see Working with global policies.

Expanded support for the GraphQL send type property on the Invoke policy

The Invoke policy now additionally supports the GraphQL send type property when the Backend type is Detect, or the HTTP Method is Keep. For more information, see Invoke.

Enhancements to GraphQL support

GraphQL subscriptions are now supported in the payload, in addition to being supported in query requests.
GraphQL requests can now be sent by using the GET method, in addition to the POST method.
Two-phase introspection is now supported.
Negative weights are now supported in analysis configurations.
The default @deprecated directive now supports the reason argument for stating the reason why a field or type is marked as being deprecated.
Query validation now checks to determine whether all @directives are known by the schema and legally positioned.
The assembly validate action now correctly processes GraphQL responses that contain an error and no data or partial data.

For details of current limitations in GraphQL support, see GraphQL limitations.

Specify the testing preferences for an API

By default, when you test an API with the Test tab, a range of test parameters are configured by default. For example, a default Product is automatically generated, to which the API is added, and that Product is published to the Sandbox Catalog. However, you can now configure testing preferences for each of your APIs, including the required Product and target Catalog. For more information, see Specifying the testing preferences for an API.

Preserve headers for logging to analytics

When configuring activity logging for an API, you can now specify custom request and response headers that are preserved for logging to analytics. For more information, see Configuring activity logging.

Update a SOAP API from a WSDL file or a .zip archive

You can now use the Update WSDL option in the API Manager UI, or run the apic draft-apis:update-wsdl command in the developer toolkit, to update the configuration of an existing SOAP API. For more information, see Updating a SOAP API for the API Manager instructions, or API development and management commands for the developer toolkit CLI instructions.

Testing an API by using the Explorer tab in the API editor

You can now use the Explorer tab in the API editor of the API Manager and API Designer UIs, to see how your APIs look to a consumer in the Developer Portal. You can check the descriptions of the different artifacts, and review any schemas or examples, and you can also use the Try it tool to test the behavior of the API. For more information, see Testing an API with the Explorer tab.

Modify the headers and parameters of an API request

You can now use the following API context variables to modify the headers and parameters of an API request by customizing the preflow policies:

request.headers.name
request.original.headers.name
request.parameters.name.values
request.original.parameters.name.values

For more information, see API Connect context variables.

Extend the OpenAPI specification by using the user interface

In addition to the CLI support that was available in previous releases, you can now use the user interface to extend the OpenAPI specification, by adding either a JSON or YAML extension schema to an API. An extension is imported into a Catalog, or as Space in a Catalog, then added to the API schema. For more information, see Importing an OpenAPI extension into a Catalog and Adding an OpenAPI extension to an API.

Enhanced SwaggerDoc (OpenAPI 2.0) and OpenAPI 3.0 validation

Validation of SwaggerDoc (OpenAPI 2.0) and OpenAPI 3.0 documents by is now done by the API Dev Tools Swagger Parser at stage or publish time. This also includes de-referencing of documents to ensure that included local references (that is, $ref properties) are valid. For more information on staging and publishing APIs, see the following topics:

Note: If you are upgrading an existing API Connect installation, you should check whether your existing OpenAPI files are parsable and considered valid by the API Dev Tools Swagger Parser. For more information see one of the following topics depending on your platform:

Directly navigate to specific APIs and operations in the Open API Explorer Documentation

You can now use the URL to navigate directly to specific APIs and operations in the OpenAPI Explorer Documentation for the API Connect REST APIs. You can also select the APIs for a specific version by using the drop-down menu in the header bar. See Open API Explorer Documentation for Version 10 and later.

What's new for API product managers

Transfer ownership of a Catalog or Space: You can now transfer the ownership of a Catalog or Space to another user. Optionally, you can also have the ownership of all Spaces in a Catalog transferred to the new organization owner. For more information, see Creating and configuring Catalogs and Creating, modifying, and deleting Spaces.
Transfer ownership of a Consumer organization: You can now transfer the ownership of a consumer organization to another user. For more information, see Editing a consumer organization.
Add member option now available when adding users to a provider organization: When you add a user to a provider organization, you can now use the Add member option to have a new or existing user added immediately without sending an activation email. For more information, see Adding provider organization users and assigning roles.
Send email messages to consumer organization owners: You can now send an email message to the owners of selected consumer organizations, or to the owners of all the organizations in a consumer organization group. For more information, see Sending messages to consumer organization owners and Working with consumer organization groups.
Toggle the visibility and subscribability of a Product: You can now control whether or not a Product in a Catalog is visible or subscribable with a single check box. For more information, see Changing the availability of a Product.
Modify Product visibility and subscribability settings when publishing: Product visibility and subscribability settings are initially configured in the draft Product definition. However, you can now modify these settings when publishing the Product. For more information, see Publishing a draft Product.
Retain Version 5 vanity endpoint behavior in a Catalog by using the API Manager user interface: In addition to the developer toolkit CLI support that was provided in Version 10.0.0.0, you can now modify your Catalog settings to retain the Version 5 vanity endpoint behavior by using the API Manager user interface. For more information, see Retain Version 5 vanity endpoint behavior in a Catalog.
Migrate application subscriptions: You can now migrate application subscriptions from one Product to another Product. For more information, see Migrating application subscriptions to another Product.
Additional configuration options for onboarding API consumers into a Catalog: You can now require approval for all new self service onboarding to the Developer Portal, and configure the ability for API consumers to invite collaborators and assign them to roles in the Developer Portal. For more information, see Creating and configuring Catalogs.
View and edit the email notification templates in different languages: You can now view and edit the email notification templates in different languages. For more information, see Configuring notifications in the API Manager UI.
Retain the OAuth Authorization header for a third-party OAuth provider: When configuring a third-party OAuth provider, you can now select to retain the Authorization header for a bearer token. For full details on configuring a third party OAuth provider, see Configuring a third-party OAuth provider.
Product managers can now review API Plan subscription requests more quickly: If an API Plan has been configured to require subscription approval, the approval emails for the subscription requests now contain links that take Product managers directly to the Task page in the appropriate Catalog so that they can review the request. For more information, see Approving Product lifecycle and subscription requests.
View the Client ID's for a Product subscription per application: For each Product subscription, you can now view all of the Client IDs per application. For more information, see Working with developer applications and Working with the subscriptions in a Product.
View the history of Product lifecycle requests: You can now view the history of Product lifecycle requests and approvals in the API Manager UI. For more information, see Publishing a Product.
Ability to view which Catalogs or Spaces a Product is published to: You can now view which Catalogs, or Spaces if applicable, a particular Product has been published to from within the Product itself. For more information, see Publishing a draft Product.

What's new for API consumers

New activity feed for Consumer organizations on the Developer Portal: The Developer Portal now includes an activity feed that shows Consumer organization users the details of events that occur on the organization, such as application creation, subscriptions, and so on. This activity feed is displayed by default on the navigation bar of the organization, and as an additional tab on the organization page and the application page.

What's new for Developer Portal administrators

Directly navigate to a specific Product or API in the Developer Portal

You can navigate directly to a specific Product or API in the Developer Portal by using x-ibm-name:version in the URL. For more information, see How to use a URL to navigate directly to a Product or API in the Developer Portal.

Upgrade from Drupal 8 to Drupal 9 content management system

The Developer Portal is now based on the Drupal 9 content management system. This is an in-place upgrade, so no specific steps need to be taken. However, if you are using additional contributed modules, or custom modules or sub-themes, you should check that they are compatible with Drupal 9, and not using any deprecated APIs for example. There are tools available for checking your custom code, such as drupal_check on GitHub, which checks Drupal code for deprecations. For information about how to make the core version of custom modules or sub-themes compatible with Drupal 9, see Installing Drupal 8 based custom modules or sub-themes into the Drupal 9 based Developer Portal. For more information about Drupal 9, see About Drupal 9 on the drupal.org website.

New security and service-ip-allowlist commands available in the Developer Portal command-line tool

The following commands are now available in the Developer Portal command-line tool to help you manage IP addresses:

apic security:clear-bans - Clear all of the banned user/IP addresses on a portal site. For more information, see Using the security command.
service-ip-allowlist - Add, delete, list, or remove IP addresses on the allowlist to manage which IP addresses are exempt from being blocked by portal security checks. For more information, see Using the service-ip-allowlist command.

Configure the notifications event log settings for your Developer Portal

The Developer Portal now includes an activity feed that shows Consumer organization users the details of events that occur on the organization, and you can configure the amount of days that the events are kept for. For more information, see Configuring the notifications event log settings.

What's new for DevOps

Transfer ownership of a provider organization

You can now transfer the ownership of a provider organization to another user. Optionally, you can also have the ownership of all Catalogs and Spaces in the organization transferred to the new organization owner. For more information, see Editing a provider organization.

Send emails to provider organization owners

You can now send an email message to the owner of a provider organization. For more information, see Sending messages to provider organization owners.

Autoscaling gateway pods

Autoscaling enables the gateway deployment to scale dynamically, either vertically or horizontally, based on memory and CPU. Configure autoscaling settings in the Gateway CR. For more information, see Gateway subsystem settings (OpenShift, Cloud Pak for Integration) or Installing the DataPower Gateway subsystem (Kubernetes).

New Product information tile

In the

Help page of the Cloud Manager, API Manager, and API Designer user interfaces, there's a new Product information tile. Click this tile to find out information about your product versions, and Git information about the package versions being used. Note that the API Designer product information is based on its associated management server, but the Git information is based on where it was downloaded from.

View and edit the email notification templates in different languages

You can now view and edit the email notification templates in different languages. For more information, see Customizing email notification templates in the Cloud Manager UI.

Retain the OAuth Authorization header for a third-party OAuth provider

When configuring a third-party OAuth provider, you can now select to retain the Authorization header for a bearer token. For full details on configuring a third party OAuth provider, see Configuring a third-party OAuth provider.

Timestamp format changed for Developer Portal restore operations

The timestamp format that is used in Developer Portal restore operations has changed from YYYY-MM-DD HH:MM:SS to YYYYMMDD.HHMMSS. For more information, see:

No hard analytics data retention limit

The default retention period for analytics data indexes is 90 days. Although there is no hard retention limit, we don't recommend exceeding 10 years. For more information, see Configuring data retention and index rollover time periods.

What's new for IT architects

Performance improvements

IBM API Connect Version 10.0.3.0 contains numerous performance enhancements to many of the main API management functions. The following list provides an overview of the key results:

Product staging and publishing: Significant improvement in these critical functions compared to Version 10.0.2.0 are delivered. Elapsed time reductions up to 80% for staging, and 70% for publishing, are observed for certain workloads.
Publish preserve subscriptions: For customers that have products with many subscriptions, and invoke the publish preserve subscriptions function, there is up to a 97% reduction in elapsed time.
IBM API Connect Version 5 parity: Significant performance gaps existed between V5 and V10 of API Connect. However, in many cases and scenarios now the performance in V10.0.3.0 is better than in V5.
Product replace: For customers that have a large number of subscriptions for a single Product, an 83% reduction in elapsed time can be observed when testing the Product replace function.
Add new subscription on top of existing subscriptions: API runtime availability on the Gateway for a new subscription that is added on top of many existing subscriptions, is improved in this release. For example, in a database with 10,000 subscriptions, a new subscription was invokable in approximately 40 seconds, as compared to 4 minutes in previous releases.
API Manager Gateway improved scalability: Significant changes have been made to the API Manager and Gateway synchronization processing, which has resulted in much reduced memory usage by the Gateways. This reduction has led to the improved scalability of subscriptions on the Gateways, and a reduced time for the subscriptions on API Manager to become available and active on the Gateways.
API Manager Gateway synchronization disaster risk reduction (DRR): After a DRR event on a Gateway, the API Manager must re-sync all objects with the Gateway, and this sync time has been reduced. For example, in a database with 10,000 subscriptions, a DRR/sync completed in 161 seconds.

Note: These results were observed in an IBM laboratory. Results might vary in other environments, and are not guaranteed.

What's new for security practitioners

Restrict the ability of users with the Member > Manage permission to assign roles

You can now apply a restriction such that, for a user with the Member > Manage permission to assign a role, they must themselves have at least all of the permissions that are applied to that role. For more information, see API Connect user roles.

Create custom user registries by using the UI

You can now create custom user registries by using the Cloud Manager and API Manager UIs, in addition to using the developer toolkit CLI. Custom user registries can be used for authenticating users to the Cloud Manager, the API Manager, and the Developer Portal. For more information, see Configuring a shared custom user registry.

Syslog endpoints now supported in audit logging

You can now set syslog endpoints when you configure audit settings for your API calls. For more information, see Configuring the audit settings.

SSH key based backup for Postgres databases is now supported

SSH key based backup is now supported for Postgres databases. Refer to the following sections for more information: